{"id":24668,"date":"2026-09-16T20:32:37","date_gmt":"2026-09-16T12:32:37","guid":{"rendered":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89981"},"modified":"2026-09-16T20:32:37","modified_gmt":"2026-09-16T12:32:37","slug":"cve-2026-89981","status":"publish","type":"vuln","link":"https:\/\/www.54iter.cn\/?vuln=cve-2026-89981","title":{"rendered":"CVE-2026-89981 &#8211; In the Linux kernel, the following vulnerability has been resolved:\n\narm64: Don&#8217;t read GMI"},"content":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>arm64: Don&#8217;t read GMID_EL1 when MTE is disabled<\/p>\n<p>__cpuinfo_store_cpu() gates the GMID_EL1 read on the raw<br \/>\nID_AA64PFR1_EL1, so it reads the register even when the kernel has<br \/>\ndisabled MTE (CONFIG_ARM64_MTE=n or arm64.nomte). KVM sets HCR_EL2.TID5<br \/>\nin that case, and pKVM injects an UNDEF the host cannot handle:<\/p>\n<p>  Internal error: Oops &#8211; Undefined instruction: 0000000002000000 [#1]  SMP<br \/>\n  pc : __cpuinfo_store_cpu+0xf4\/0x264<br \/>\n  Kernel panic &#8211; not syncing: Attempted to kill the idle task!<\/p>\n<p>Only pKVM reaches it, and only after a CPU is offlined and brought back<br \/>\nonline: its CPU_ON relay sets the host HCR before the CPU enters EL1,<br \/>\nwhile plain nVHE sets it at CPUHP_AP_KVM_ONLINE.<\/p>\n<p>Gate the read on the CPU&#8217;s own ID_AA64PFR1_EL1 with the command-line<br \/>\noverride applied, and on CONFIG_ARM64_MTE, which no register reflects.<br \/>\nThe boot CPU stores its registers before init_cpu_features() strips an<br \/>\nunsafe override, so clamp against the hardware value here too.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>In the Linux kernel, the following vulnerability has been resolved:<\/p>\n<p>arm64: Don&#8217;t read GMID_EL1 when MTE is disabled<\/p>\n<p>__cpuinfo_store_cpu() gates the GMID_EL1 read on the raw<br \/>\nID_AA64PFR1_EL1, so it re<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-24668","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/24668","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=24668"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=24668"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=24668"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}